Security audit

Official Feishu Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Feishu office integration, but it needs review because it exposes powerful tenant actions through an unauthenticated local API and recommends running an unverified remote installer.

Review before installing in any real Feishu tenant. Avoid the curl | sh installer unless you can inspect and verify the downloaded script, run the service bound only to localhost, add a local API token or other caller authentication, grant the Feishu app only the minimum required scopes, and require explicit human confirmation for approvals, message sending, deletes, and business-record changes.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:53
Finding: Unverified Remote Installer Is Executed Directly by the Shell
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server/feishu_toolkit/main.py:24
Finding: Unauthenticated API Exposes Tenant-Privileged Feishu Operations
Content: View full analysis
dict: payload = { "approval_code": req.approval_code, "instance_code": req.instance_code, "task_id": req.task_id, "user_id": req.open_id, } if req.comment: payload["comment"] = req.comment if req.form: payload["form"] = req.form feishu_request( "POST", "/open-apis/approval/v4/tasks/approve", params={"user_id_type": "open_id"}, json_body=payload, ) return {"success": True, "task ...[truncated 3379 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: server/feishu_toolkit/main.py:39
Finding: Validation Errors Log Complete Request Bodies
Content: View full analysis
JSONResponse: logger.error( "Validation error on %s %s. body=%s errors=%s", request.method, request.url.path, exc.body, exc.errors(), ) return JSONResponse( status_code=422, content=jsonable_encoder({"detail": exc.errors()}), ) ``` ### Technical Analysis When FastAPI rejects a request during validation, the handler writes `exc.body` to the error log. The affected endpoints accept business-sensitive values such as: - Message recipients and message content. - Approval forms, comments, identities, and workflow identifiers. - Employee identifiers and attendance query parameters. - Calendar details and attendee information. - Bitable record contents. A malformed request can therefore cause its complete body to be retained in application logs. Logs commonly have different access controls, backups, retention periods, and external forwarding destinations from the primary service, increasing the number of systems and operators that may see the data. ### Attack Path 1. A legitimate client or attacker submits a request containing sensitive organizational or personal data. 2. One field is missing, malformed, or has an incompatible type. 3. FastAPI raises `RequestValidationError`. 4. The global handler interpolates the entire `exc.body` value into an error-level log entry. 5. The body is retained locally or forwarded to a centralized logging platform. 6. A person or system with log access obtains data that was not intended for the logging environment. An attacker could also deliberately send secrets or personal data in invalid requests to con ...[truncated 468 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: server/pyproject.toml:7
Finding: Open-Ended Dependency Constraints Produce Unreviewed and Non-Reproducible Builds
Content: View full analysis
=0.110.0", "httpx>=0.27.0", "uvicorn[standard]>=0.29.0", "truststore>=0.9.0", ] [project.optional-dependencies] dev = [ "pytest>=8.0.0", ] [build-system] requires = ["hatchling"] build-backend = "hatchling.build" ``` No lockfile or dependency hashes were present in the audited project structure. ### Technical Analysis Every dependency uses an open-ended lower-bound constraint. A future package release that satisfies the constraint can therefore be selected during installation without any corresponding change to this repository. This makes builds non-reproducible and weakens supply-chain review: the dependencies installed by one user may differ from those installed by another user or from those examined during an audit. The `uvicorn[standard]` extra may also introduce transitive dependencies whose versions are not represented in this file. No evidence was found that the named dependencies are currently malicious, misspelled, or sourced from an untrusted index. The risk arises from permitting unreviewed future versions and from the absence of integrity-pinned resolution data. ### Attack Path 1. A dependency account, release pipeline, or package-index distribution path is compromised, or a future release introduces a security regression. 2. A new version still satisfies the project's `>=` constraint. 3. A user runs the documented installation command without a reviewed lockfile. 4. The resolver selects the new package or affected transitive dependency. 5. Package-controlled code executes during installation, import, or application runtime. 6. The package gains access to the service process, including its environment and Feishu application credentials. ### Impact Assessment A compromised runtime dependency ex ...[truncated 414 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (59)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The README recommends piping a remotely fetched script directly into sh, which executes unreviewed code from the network with the user's privileges. If the hosting endpoint, transport, or upstream content is compromised, an attacker can run arbitrary commands, steal Feishu credentials, modify files, or install persistence during setup.
Content: Scanner excerpt · README.md (reported line 27)May include surrounding context.
或在 AI IDE（Cursor / Copilot / Windsurf / Trae 等）中：

bash
curl -sL "https://backend.clawd.org.cn/api/skills/official%2Ffeishu-toolkit/install.sh" | sh

⚙️ 配置

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The command chain using | sh is a classic unsafe execution pattern because it removes any inspection boundary between download and code execution. In this skill's context, the danger is amplified because installation is expected to precede configuring high-privilege enterprise API credentials, making any compromise especially valuable to an attacker.
Content: Scanner excerpt · README.md (reported line 27)May include surrounding context.
或在 AI IDE（Cursor / Copilot / Windsurf / Trae 等）中：

bash
curl -sL "https://backend.clawd.org.cn/api/skills/official%2Ffeishu-toolkit/install.sh" | sh

⚙️ 配置

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 54)May include surrounding context.
bash
cd server/ uv venv && uv pip install -e ".[dev]" uv run --env-file .env uvicorn feishu_toolkit.main:app --host 127.0.0.1 --port 8002

4. 验证

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.
bash
cd server/ uv venv && uv pip install -e ".[dev]" uv run --env-file .env uvicorn feishu_toolkit.main:app --host 127.0.0.1 --port 8002

4. 验证

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · server/feishu_toolkit/approval_api.py (reported line 94)May include surrounding context.
python
```bash cd server/ uv venv && uv pip install -e ".[dev]" uv run --env-file .env uvicorn feishu_toolkit.main:app --host 127.0.0.1 --port 8002 ``` ### 4. 验证

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · server/feishu_toolkit/approval_api.py (reported line 125)May include surrounding context.
python
```bash cd server/ uv venv && uv pip install -e ".[dev]" uv run --env-file .env uvicorn feishu_toolkit.main:app --host 127.0.0.1 --port 8002 ``` ### 4. 验证

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述将该技能表述为“全面集成工具包”，并明确列出六大核心办公模块。但提供的代码片段实际只涉及 calendar_api.py 中的日历和会议室预约相关接口调用，主要访问 Feishu Calendar 和 VC Rooms API。没有任何与消息、审批、表格、通讯录、考勤相关的路由、数据模型或 API 调用。就‘描述是否准确代表该代码块实际行为’这一标准看，描述明显宽于代码实际能力，因此存在描述与行为不一致。
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The installation instructions fetch and execute a remote shell script directly from the network. If the server, distribution path, TLS trust chain, or upstream content is compromised, users may execute arbitrary code immediately during installation.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
或在 AI IDE（Cursor / Copilot / Windsurf / Trae 等）中：

bash
curl -sL "https://backend.clawd.org.cn/api/skills/official%2Ffeishu-toolkit/install.sh" | sh

⚙️ 配置

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Using '| sh' creates a dangerous command chain that removes the opportunity for inspection and executes whatever bytes are returned by the remote endpoint. In a skill install context, this is especially risky because it normalizes blind code execution for users setting up software with access to enterprise credentials and APIs.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
或在 AI IDE（Cursor / Copilot / Windsurf / Trae 等）中：

bash
curl -sL "https://backend.clawd.org.cn/api/skills/official%2Ffeishu-toolkit/install.sh" | sh

⚙️ 配置

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 92% confidence
Finding: The documented DELETE endpoint enables destructive modification of calendar data, and the surrounding documentation does not provide strong safety constraints, confirmation guidance, or misuse prevention advice. In an agent-integrated office suite, such actions can be triggered on user-facing identifiers and may cause loss of important meeting records or disruptions to business operations.
Content: Scanner excerpt · references/calendar.md (reported line 229)May include surrounding context.
删除指定的日程事件。

text
DELETE /calendar/events/{event_id}

可选查询参数：

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 89% confidence
Finding: The workflow guidance explicitly recommends deleting test calendar data, normalizing use of a destructive action without emphasizing safeguards. This can condition users or agents to invoke deletion casually, increasing the chance of deleting the wrong event in a production tenant.
Content: Scanner excerpt · references/calendar.md (reported line 255)May include surrounding context.
md
### 清理测试数据 - 通过 `DELETE /calendar/events/{event_id}` 删除测试产生的日程 ### 预约会议室

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The explicit upstream deletion path shows that a local tool invocation can translate into permanent remote calendar changes. In context, this makes the capability more dangerous because the skill integrates with real enterprise scheduling data rather than a harmless local mock.
Content: Scanner excerpt · references/calendar.md (reported line 283)May include surrounding context.
md
| `GET /calendar/rooms` | `GET /open-apis/vc/v1/rooms` | | `POST /calendar/rooms/search` | `POST /open-apis/vc/v1/rooms/search` | | `POST /calendar/events/{event_id}/attendees` | `POST /open-apis/calendar/v4/calendars/:calendar_id/events/:event_id/attendees` | | `DELETE /calendar/events/{event_id}` | `DELETE /open-apis/calendar/v4/calendars/:calendar_id/events/:event_id` |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The explicit upstream deletion path shows that a local tool invocation can translate into permanent remote calendar changes. In context, this makes the capability more dangerous because the skill integrates with real enterprise scheduling data rather than a harmless local mock.
Content: Scanner excerpt · references/calendar.md (reported line 283)May include surrounding context.
md
| `GET /calendar/rooms` | `GET /open-apis/vc/v1/rooms` | | `POST /calendar/rooms/search` | `POST /open-apis/vc/v1/rooms/search` | | `POST /calendar/events/{event_id}/attendees` | `POST /open-apis/calendar/v4/calendars/:calendar_id/events/:event_id/attendees` | | `DELETE /calendar/events/{event_id}` | `DELETE /open-apis/calendar/v4/calendars/:calendar_id/events/:event_id` |

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises capabilities that can send messages, modify calendars, initiate approvals, and edit organizational records, but it does not clearly warn that the agent will perform actions on the user's behalf against real enterprise data. In an office-suite context, that omission increases the risk of accidental unauthorized actions, social-engineering-assisted misuse, or users enabling a powerful skill without understanding its operational impact.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises significant capabilities that require environment-variable access and network communication, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens transparency and policy enforcement, making it harder for users and host platforms to understand and restrict what the skill can access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill can send messages, initiate approval workflows, and modify enterprise records on a user's behalf, but the description does not prominently warn users about these high-impact actions. In an enterprise context, missing warnings increase the risk of accidental misuse, unauthorized business actions, or surprising data changes.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 60% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · references/approval.md (reported line 15)May include surrounding context.
md
飞书不提供"列出所有审批定义"的 API，需要手动从管理后台获取： 1. 打开 [飞书审批管理后台（开发者模式）](https://www.feishu.cn/approval/admin/approvalList?devMode=on) 2. 找到目标审批，点击 **编辑** 按钮 3. 在浏览器地址栏中复制 `definitionCode=` 后面的值，例如： `https://www.feishu.cn/approval/admin/edit?definitionCode=48D49517-C979-447E-AD93-4BAE0FBC57EA`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/approval.md (reported line 92)May include surrounding context.
请求示例：

bash
curl -X POST http://127.0.0.1:8002/approval/create \ -H "Content-Type: application/json" \ -d '{ "approval_code": "48D49517-C979-447E-AD93-4BAE0FBC57EA",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This section documents approve, reject, transfer, and cancel operations that directly mutate workflow state, but it does not warn that these are irreversible or high-impact actions nor recommend explicit user confirmation before execution. In an agent setting, that omission increases the chance of accidental approvals, rejections, transfers, or recalls based on ambiguous natural-language requests, affecting HR, finance, or compliance processes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation for the transfer-approval endpoint is internally inconsistent: it says the request should include transfer_open_id, but the parameter table and example show fields for the cancel endpoint instead. In an approval workflow, this can cause an agent or operator to invoke the wrong state-changing action or construct malformed requests, leading to unintended cancellation or failed processing of business approvals.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/approval.md (reported line 236)May include surrounding context.
请求示例：

bash
curl -X POST http://127.0.0.1:8002/approval/cancel \ -H "Content-Type: application/json" \ -d '{ "approval_code": "48D49517-C979-447E-AD93-4BAE0FBC57EA",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document describes querying highly sensitive employee attendance data, including clock-in/out results, remedy records, employee names, and attendance group details, but provides no privacy warning, access-limitation guidance, or data-handling constraints. In an agent skill context, this omission increases the risk that operators or downstream agents will treat HR data as routine operational data and expose or over-collect personal workforce information.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/attendance.md (reported line 33)May include surrounding context.
请求示例：

bash
curl -X POST http://127.0.0.1:8002/attendance/tasks \ -H "Content-Type: application/json" \ -d '{ "user_ids": ["abd754f7"],

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/attendance.md (reported line 96)May include surrounding context.
请求示例：

bash
curl -X POST http://127.0.0.1:8002/attendance/remedys \ -H "Content-Type: application/json" \ -d '{ "user_ids": ["abd754f7"],

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

External Script Fetching

⚙️ 配置

Chaining Abuse

⚙️ 配置

Credential Access

4. 验证

Credential Access

4. 验证

Credential Access

Credential Access

Tp4

External Script Fetching

⚙️ 配置

Chaining Abuse

⚙️ 配置

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Unsafe Defaults

External Transmission

Missing User Warnings

Intent-Code Divergence

External Transmission

Missing User Warnings

External Transmission

External Transmission

Static analysis